End-to-end data encryption and decryption method and device, storage medium and equipment

Abstract

The invention discloses an end-to-end data encryption and decryption method and device, a storage medium and equipment, and the method comprises the steps that a first client side firstly responds to a login request of a target user on first terminal equipment, determines an IK corresponding to the target user and the first terminal equipment, and transmits the IK to a server side; and then in response to a session request sent by a target user, sending the generated session identifier to a server side so as to obtain the EDK encrypted by the public key in the IK from the server side. And the encrypted EDK is decrypted by using a private key in the IK, and the session content is encrypted and digitally signed by using the decrypted EDK. And sending the signed encrypted session content to the second client, so that the second client decrypts the encrypted EDK by using a private key in the IK acquired from the server after the signature verification is passed, and decrypts the encrypted session content by using the decrypted EDK to obtain the decrypted session content. Therefore, the transmission security of the session content is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an end-to-end data encryption and decryption method, device, storage medium and equipment. Background Art

[0002] At present, government workers generally use their own instant messaging tools to handle government affairs, and these instant messaging tools do not securely encrypt the messages generated. Although this current message transmission method is convenient, it also hides the risk of data leakage. Therefore, it is necessary to encrypt and decrypt these instant messaging messages to ensure the security of data transmission.

[0003] The existing method of encrypting and decrypting instant messaging messages usually uses a fixed and unified key to encrypt and decrypt to ensure the security of the messages. However, this method is also difficult to ensure the security of data transmission. For example, once the communication data between user A and user B is cracked, the communication data between user A and all other users such as user C and user D will also be cracked. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to provide an end-to-end data encryption and decryption method, device, storage medium and equipment, which can improve the transmission security of instant messaging messages through a data encryption and decryption method of "one machine, one secret, one conversation, one secret".

[0005] In a first aspect, an embodiment of the present application provides an end-to-end data encryption and decryption method, which is applied to a first client installed on a first terminal device, including:

[0006] In response to a login request of a target user at a first terminal device, determining an identity key IK corresponding to the target user and the first terminal device; and sending the IK to a server to which the first client belongs;

[0007] In response to a session request sent by the target user, the generated session identifier is sent to the server side, so as to obtain the encrypted data key EDK encrypted by the public key in the IK from the server side;

[0008] Decrypting the encrypted EDK using the private key in the IK, and encrypting and digitally signing the session content sent by the target user using the decrypted EDK;

[0009] The signed encrypted session content is sent to the second client, so that after the signature verification is passed, the second client uses the private key in the IK obtained from the server to decrypt the encrypted EDK, and uses the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0010] In a possible implementation, in response to a login request of a target user at a first terminal device, determining an identity key IK corresponding to the target user and the first terminal device includes:

[0011] In response to a login request of a target user at a first terminal device, judging, according to an identifier of the target user and an identifier of the first terminal device, whether an identity key IK corresponding to the target user and the first terminal device already exists;

[0012] If not, an identity key IK corresponding to the target user and the first terminal device is generated and stored according to the identifier of the target user and the identifier of the first terminal device; the IK includes a public key and a private key.

[0013] In a possible implementation manner, the session identifier is a one-to-one chat session identifier or a many-to-many group chat session identifier.

[0014] In a possible implementation, the encrypted EDK is generated as follows:

[0015] The session identifier and the public key in the IK are sent to the cryptographic platform through the server side so that the cryptographic platform can determine whether the EDK corresponding to the session identifier exists; if it exists, the EDK encrypted by the public key in the IK is returned to the server side; if it does not exist, the EDK is generated according to the session identifier by using the encryption machine, and the EDK encrypted by the public key in the IK is returned to the server side.

[0016] In a possible implementation, the step of using the decrypted EDK to encrypt and digitally sign the session content sent by the target user includes:

[0017] Encrypt the session content sent by the target user using the decrypted EDK to obtain the ciphertext of the session content;

[0018] A 128-bit first summary of the ciphertext of the session content is extracted using a one-way hash function, and the 128-bit first summary is encrypted using a private key in the IK to obtain an encrypted first summary.

[0019] In a possible implementation, the sending of the signed encrypted session content to the second client so that the second client decrypts the encrypted EDK using the private key in the IK obtained from the server after the signature verification is passed, and decrypts the encrypted session content using the decrypted EDK to obtain the decrypted session content, including:

[0020] Sending the ciphertext of the session content, the encrypted first digest and the public key in the IK to the second client, so that the second client extracts the 128-bit second digest of the ciphertext of the session content by using a one-way hash function, and decrypts the encrypted first digest by using the public key in the IK to obtain the decrypted 128-bit first digest, and after determining that the 128-bit second digest is equal to the decrypted 128-bit first digest, decrypts the encrypted EDK by using the private key in the IK obtained from the server, and decrypts the ciphertext of the session content by using the decrypted EDK to obtain the decrypted session content.

[0021] In a second aspect, an embodiment of the present application further provides an end-to-end data encryption and decryption method, which is applied to a second client installed on a second terminal device, comprising:

[0022] Receive the signed encrypted session content sent by the first client installed on the first terminal device; wherein the signed encrypted session content is obtained by encrypting and digitally signing the session content sent by the target user using the decrypted EDK; the decrypted EDK is obtained by decrypting the encrypted EDK using the private key in the IK; the encrypted EDK is obtained by encrypting the public key in the IK after being obtained from the server to which the first client belongs according to the session identifier; the IK is determined by the first client in response to the target user's login request on the first terminal device;

[0023] The signed encrypted session content is verified, and after the verification is passed, the encrypted EDK is decrypted using the private key in the IK obtained from the server, and the encrypted session content is decrypted using the decrypted EDK to obtain the decrypted session content.

[0024] In a possible implementation, the receiving of the signed encrypted session content sent by the first client installed on the first terminal device includes:

[0025] Receiving the ciphertext of the session content, the encrypted first digest and the public key in the IK sent by the first client installed on the first terminal device;

[0026] Among them, the ciphertext of the session content is obtained by the first client using the decrypted EDK to encrypt the session content sent by the target user; the encrypted first summary is obtained by the first client using a one-way hash function to extract the 128-bit first summary of the ciphertext of the session content, and then encrypting the 128-bit first summary using the private key in the IK.

[0027] In a possible implementation, verifying the signed encrypted session content includes:

[0028] Extracting a 128-bit second summary of the ciphertext of the session content using a one-way hash function, and decrypting the encrypted first summary using the public key in the IK to obtain a decrypted 128-bit first summary;

[0029] It is determined whether the 128-bit second digest is equal to the decrypted 128-bit first digest. If so, the signature verification is successful; if not, the signature verification fails.

[0030] In a possible implementation, after the signature verification is passed, the encrypted EDK is decrypted using the private key in the IK obtained from the server, and the encrypted session content is decrypted using the decrypted EDK to obtain the decrypted session content, including:

[0031] After the signature verification is passed, determine whether the EDK corresponding to the session identifier already exists;

[0032] If yes, the private key in the IK is obtained from the server; if no, the session identifier is sent to the server so as to obtain the EDK encrypted by the public key in the IK and the private key in the IK from the server;

[0033] The encrypted EDK is decrypted using the private key in the IK, and the encrypted session content is decrypted using the decrypted EDK to obtain the decrypted session content.

[0034] In a third aspect, an embodiment of the present application further provides an end-to-end data encryption and decryption device, which is applied to a first client installed in a first terminal device, including:

[0035] A determination unit, configured to determine, in response to a login request of a target user at a first terminal device, an identity key IK corresponding to the target user and the first terminal device; and send the IK to a server to which the first client belongs;

[0036] A first sending unit, configured to send the generated session identifier to the server side in response to a session request sent by the target user, so as to obtain the encrypted data key EDK encrypted by the public key in the IK from the server side;

[0037] An encryption unit, used to decrypt the encrypted EDK using the private key in the IK, and to encrypt and digitally sign the session content sent by the target user using the decrypted EDK;

[0038] A decryption unit is used to send the signed encrypted session content to the second client, so that the second client can use the private key in the IK obtained from the server to decrypt the encrypted EDK after the signature verification, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0039] In a possible implementation manner, the determining unit includes:

[0040] A judgment subunit, configured to respond to a login request of a target user at a first terminal device and judge, according to an identifier of the target user and an identifier of the first terminal device, whether an identity key IK corresponding to the target user and the first terminal device already exists;

[0041] A generating subunit is used to generate and store the identity key IK corresponding to the target user and the first terminal device according to the identifier of the target user and the identifier of the first terminal device if it is determined that the identity key IK corresponding to the target user and the first terminal device does not exist; the IK includes a public key and a private key.

[0042] In a possible implementation manner, the session identifier is a one-to-one chat session identifier or a many-to-many group chat session identifier.

[0043] In a possible implementation manner, the device further includes:

[0044] The second sending unit is used to send the session identifier and the public key in the IK to the cryptographic platform through the server side, so that the cryptographic platform determines whether the EDK corresponding to the session identifier exists; if it exists, the EDK encrypted by using the public key in the IK is returned to the server side; if it does not exist, the EDK is generated according to the session identifier by using the encryption machine, and the EDK encrypted by using the public key in the IK is returned to the server side.

[0045] In a possible implementation, the encryption unit includes:

[0046] A first encryption subunit, configured to encrypt the session content sent by the target user using the decrypted EDK to obtain a ciphertext of the session content;

[0047] The second encryption subunit is used to extract the 128-bit first summary of the ciphertext of the session content by using a one-way hash function, and encrypt the 128-bit first summary by using the private key in the IK to obtain the encrypted first summary.

[0048] In a possible implementation, the decryption unit is specifically used for:

[0049] Sending the ciphertext of the session content, the encrypted first digest and the public key in the IK to the second client, so that the second client extracts the 128-bit second digest of the ciphertext of the session content by using a one-way hash function, and decrypts the encrypted first digest by using the public key in the IK to obtain the decrypted 128-bit first digest, and after determining that the 128-bit second digest is equal to the decrypted 128-bit first digest, decrypts the encrypted EDK by using the private key in the IK obtained from the server, and decrypts the ciphertext of the session content by using the decrypted EDK to obtain the decrypted session content.

[0050] In a fourth aspect, an embodiment of the present application further provides an end-to-end data encryption and decryption device, which is applied to a second client installed on a second terminal device, including:

[0051] A receiving unit, configured to receive the signed encrypted session content sent by the first client installed on the first terminal device; wherein the signed encrypted session content is obtained by encrypting and digitally signing the session content sent by the target user using the decrypted EDK; the decrypted EDK is obtained by decrypting the encrypted EDK using the private key in the IK; the encrypted EDK is obtained by encrypting the public key in the IK after being obtained from the server to which the first client belongs according to the session identifier; the IK is determined by the first client in response to a login request of the target user on the first terminal device;

[0052] The decryption unit is used to verify the signed encrypted session content, and after the verification is passed, use the private key in the IK obtained from the server to decrypt the encrypted EDK, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0053] In a possible implementation, the receiving unit is specifically configured to:

[0054] Receiving the ciphertext of the session content, the encrypted first digest and the public key in the IK sent by the first client installed on the first terminal device;

[0055] Among them, the ciphertext of the session content is obtained by the first client using the decrypted EDK to encrypt the session content sent by the target user; the encrypted first summary is obtained by the first client using a one-way hash function to extract the 128-bit first summary of the ciphertext of the session content, and then encrypting the 128-bit first summary using the private key in the IK.

[0056] In a possible implementation, the decryption unit includes:

[0057] A first decryption subunit is used to extract a 128-bit second summary of the ciphertext of the session content by using a one-way hash function, and decrypt the encrypted first summary by using the public key in the IK to obtain a decrypted 128-bit first summary;

[0058] The first judgment subunit is used to judge whether the 128-bit second digest is equal to the decrypted 128-bit first digest. If so, the signature verification is passed; if not, the signature verification fails.

[0059] In a possible implementation, the decryption unit further includes:

[0060] A second judgment subunit is used to judge whether the EDK corresponding to the session identifier already exists after the signature verification is passed;

[0061] an acquisition subunit, configured to acquire the private key in the IK from the server side if it is determined that the EDK corresponding to the session identifier already exists; and to send the session identifier to the server side if it is determined that the EDK corresponding to the session identifier does not exist, so as to acquire the EDK encrypted by the public key in the IK and the private key in the IK from the server side;

[0062] The second decryption subunit is used to decrypt the encrypted EDK using the private key in the IK, and decrypt the encrypted session content using the decrypted EDK to obtain the decrypted session content.

[0063] In a fifth aspect, an embodiment of the present application further provides an end-to-end data encryption and decryption system, including: a first client installed on a first terminal device, a second client installed on a second terminal device, and a server to which the first client and the second client belong;

[0064] The first client installed in the first terminal device is used to, in response to a login request of a target user on the first terminal device, determine the identity key IK corresponding to the target user and the first terminal device; and send the IK to the server; in response to a session request issued by the target user, send the generated session identifier to the server, so as to obtain from the server an encrypted data key EDK encrypted by the public key in the IK; decrypt the encrypted EDK using the private key in the IK, and use the decrypted EDK to encrypt and digitally sign the session content issued by the target user; and send the signed encrypted session content to the second client;

[0065] The server is used to receive the IK and session identifier sent by the first client; send the session identifier and the public key in the IK to the cryptographic platform, so that the cryptographic platform determines whether the EDK corresponding to the session identifier exists; if it exists, return the EDK encrypted by the public key in the IK to the server; if it does not exist, generate the EDK according to the session identifier by using the encryption machine, and return the EDK encrypted by the public key in the IK to the server;

[0066] The second client is used to receive the signed encrypted session content sent by the first client; verify the signed encrypted session content, and after the verification is passed, use the private key in the IK obtained from the server to decrypt the encrypted EDK, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0067] In a sixth aspect, an embodiment of the present application further provides an end-to-end data encryption and decryption device, including: a processor, a memory, and a system bus;

[0068] The processor and the memory are connected via the system bus;

[0069] The memory is used to store one or more programs, and the one or more programs include instructions. When the instructions are executed by the processor, the processor executes any one of the implementation methods of the end-to-end data encryption and decryption method provided in the first aspect or executes any one of the implementation methods of the end-to-end data encryption and decryption method provided in the second aspect.

[0070] In the seventh aspect, an embodiment of the present application also provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a terminal device, the terminal device executes any one of the implementation methods of the end-to-end data encryption and decryption methods provided in the first and second aspects above.

[0071] In an eighth aspect, an embodiment of the present application further provides a computer program product, which, when running on a terminal device, enables the terminal device to execute any one of the implementation methods of the end-to-end data encryption and decryption methods provided in the first and second aspects above.

[0072] An end-to-end data encryption and decryption method, apparatus, storage medium and device provided by an embodiment of the present application, wherein the first client installed on the first terminal device first responds to the target user's login request on the first terminal device, determines the identity key IK corresponding to the target user and the first terminal device; and sends the IK to the server to which the first client belongs; and then responds to the session request issued by the target user, sends the generated session identifier to the server, so as to obtain the EDK encrypted by the public key in the IK from the server. Next, the encrypted EDK is decrypted using the private key in the IK, and the decrypted EDK is used to encrypt and digitally sign the session content issued by the target user. The signed encrypted session content is then sent to the second client, so that after the signature verification is passed, the second client uses the private key in the IK obtained from the server to decrypt the encrypted EDK, and uses the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0073] It can be seen that since the present application utilizes the unique identity key IK corresponding to the target user and the first terminal device and the unique encryption data key EDK corresponding to the session identifier issued by the target user, the encryption and decryption of the session content transmission process issued by the target user is realized, thereby effectively improving the transmission security of the session content issued by the target user through this "one machine, one secret, one conversation, one secret" data encryption and decryption method. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0075] Figure 1 A schematic diagram of a process flow of an end-to-end data encryption and decryption method provided in an embodiment of the present application;

[0076] Figure 2 An example diagram of the IK generation process provided in an embodiment of the present application;

[0077] Figure 3 An example diagram of the EDK generation process provided in an embodiment of the present application;

[0078] Figure 4 An example diagram of the signing and verification process provided in the embodiment of the present application;

[0079] Figure 5 An example diagram of the decryption process provided in an embodiment of the present application;

[0080] Figure 6A flowchart of another end-to-end data encryption and decryption method provided in an embodiment of the present application;

[0081] Figure 7 An interactive flow chart of an end-to-end data encryption and decryption system provided in an embodiment of the present application;

[0082] Figure 8 A schematic diagram of the composition of an end-to-end data encryption and decryption device provided in an embodiment of the present application;

[0083] Fig. 9 A schematic diagram of the composition of another end-to-end data encryption and decryption device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0084] At present, government workers generally use various instant messaging tools to handle government affairs. The security of instant messaging messages in government scenarios is basically guaranteed by these tools through "trusted identity, trusted device, trusted application, and trusted link".

[0085] Among them, "trusted identity" means that the user's identity information is verified and confirmed to be authentic, legal and reliable. That is, the real user of the instant messaging tool. "Trusted device" means that when the same user logs in to the instant messaging tool on different devices, the device needs to be bound and authenticated to ensure that the device is the device used by the user. "Trusted application" means that the application or access link address connected to the instant messaging is safe and reliable. Usually, the trustworthiness of the application is guaranteed through the application approval process such as the listing review of the application, or the security and trustworthiness of the access link address is guaranteed by configuring a whitelist or security equipment. "Trusted link" means that the information will not be maliciously tampered with, stolen or destroyed during the transmission process through encryption technologies such as SSL / TLS, IPsec and digital signatures.

[0086] However, since the existing method of encrypting and decrypting instant messaging messages usually uses a fixed and unified key to encrypt and decrypt to ensure the security of the messages, it is difficult to ensure the security of data transmission. For example, once the communication data between user A and user B is cracked, the communication data between user A and all other users such as user C and user D will also be cracked.

[0087] In order to solve the above defects, the present application provides an end-to-end data encryption and decryption method, in which the first client installed on the first terminal device first responds to the target user's login request on the first terminal device, determines the identity key IK corresponding to the target user and the first terminal device; and sends the IK to the server to which the first client belongs; then responds to the session request issued by the target user, and also sends the generated session identifier to the server, so as to obtain the EDK encrypted by the public key in the IK from the server. Then, the encrypted EDK is decrypted using the private key in the IK, and the decrypted EDK is used to encrypt and digitally sign the session content issued by the target user. Then, the signed encrypted session content is sent to the second client, so that after the second client passes the signature verification, it uses the private key in the IK obtained from the server to decrypt the encrypted EDK, and uses the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0088] It can be seen that since the present application utilizes the unique identity key IK corresponding to the target user and the first terminal device and the unique encryption data key EDK corresponding to the session identifier issued by the target user, the encryption and decryption of the session content transmission process issued by the target user is realized, thereby effectively improving the transmission security of the session content issued by the target user through this "one machine, one secret, one conversation, one secret" data encryption and decryption method.

[0089] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0090] First embodiment

[0091] See also Figure 1 , is a flow chart of an end-to-end data encryption and decryption method provided in this embodiment, which is applied to a first client installed in a first terminal device. Among them, this application does not limit the specific composition structure of the first terminal device, which can be but not limited to electronic devices such as mobile phones, tablet computers, laptops, netbooks, and wearable devices. This application does not limit the specific content of the first client, which can be but not limited to instant messaging tool clients such as WeChat and iFlytek. The method specifically includes the following steps:

[0092] S101: In response to a login request of a target user at a first terminal device, determining an identity key IK corresponding to the target user and the first terminal device; and sending the IK to a server to which the first client belongs.

[0093] In this embodiment, a user who sends an instant messaging message through a first client installed on a first terminal device is defined as a target user. In order to improve the transmission security of the instant messaging message sent by the target user, after detecting that the target user logs in to the first client by entering an account number, a password, etc., in response to the login request sent by the target user on the first terminal device, it is possible to determine whether an identity key (IK) corresponding to the target user already exists in the first terminal device according to the identifier of the target user (such as the user's identity document (ID) information such as an account number) and the identifier of the first terminal device (such as a MAC (Media Access Control Address) address, etc.); if so, no processing is required, and the IK can be directly sent to the server to which the first client belongs to continue to execute subsequent steps; if not, an existing or future password generation method can be used to generate and store an IK corresponding to the current identifier of the target user and the identifier of the first terminal device according to the identifier of the target user and the identifier of the first terminal device, so as to continue to execute subsequent steps.

[0094] Among them, IK can include a public key and a private key. The role of IK is to encrypt and decrypt the key for encrypting and decrypting the session sent to the target user mentioned later (i.e., the encryption data key (Encryption Data Key, referred to as EDK) mentioned later) to ensure the security of the session key (EDK) in network transmission, thereby improving the security of session data transmission. In addition, this application does not limit the specific content of IK, which can be set according to actual conditions and experience values.

[0095] For example: Figure 2 As shown, after the target user logs in to the first client (such as iFlytek and other instant messaging client) installed on the first terminal device (mobile phone or computer, etc.) through the account number and password, identity authentication can be performed based on the obtained target user information (such as user ID information such as the account number) (it can also be combined with face / text message and other interactive authentication with the server) to clarify the user identification ID corresponding to the target user (the specific content is not limited), and then based on the user ID and the identification of the first terminal device (such as MAC address or device ID, etc.), query whether there is an IK corresponding to the two in a one-to-one manner in the first terminal device. For example, the password module integrated in the first client in the form of SDK (specifically, the getPublickey method in the password module can be called) can be used to query whether there is a storage space in the first client of the first terminal device that stores the IK corresponding to the target user, including the public key and the private key.

[0096] If it exists, the public key in the IK is returned and sent to the server to which the first client belongs (that is, the application server corresponding to the instant messaging tool client). Otherwise, if it does not exist, the IK can be generated according to the user ID and the terminal device ID through the password module, and the generated public and private keys are stored in the password module so that the server can obtain the IK public key through the API.

[0097] Specifically, Figure 2 As shown, the key generator is first initialized to generate an IK key pair, and then the public key and private key in the IK are obtained, and the contents of the two are not limited.

[0098] For example, the public key could be:

[0099] MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0D

[0100] QgAED+MPxMsJvNrFYF0vorTmmBpAJE

[0101] b3sgFxgJc8cMoYHxKzCIq0f0pRGz+K+4bYT448PR29

[0102] BAwYxUE83hxyDvHzZQ==

[0103] The private key can be:

[0104] MIGTAgEAMBMGByqGSM49AgEGCCqB

[0105] HM9VAYItBHkwdwIBAQQg3NV8UNoLA

[0106] 2bZrMuiB7+TEScZk

[0107] T59an6NShXpyJvTsYyqCqYIKoEcz1UBqi

[0108] 2hRANCAAQP4w /

[0109] Eywm82sVqU6+it0aYGkAkRveyAXGAlzx

[0110] The two are then stored in the cryptographic module in the form of a key-value pair <user ID: public-private key pair>, and the public key in the IK is returned and sent to the server (application server) to which the first client belongs.

[0111] S102: In response to a session request sent by the target user, the generated session identifier is sent to the server side, so as to obtain the encrypted data key EDK encrypted by the public key in the IK from the server side.

[0112] In this embodiment, in order to improve the transmission security of instant messaging messages sent by the target user, it is not only necessary to determine the IK corresponding to the target user's identifier and the first terminal device in a "one-to-one" manner through step S101, but also necessary to send the generated session identifier to the server side in response to the session request sent by the target user after detecting the target user's operation of opening a session (instant messaging window) on the first client, so as to obtain from the server side the unique EDK corresponding to the session identifier and encrypted with the public key in the IK (that is, the session key mentioned in the above step S101), so as to execute the subsequent steps S103 and S104 to realize the encryption and decryption of the session content sent by the target user.

[0113] Among them, this application does not limit the generation method of the session identifier and the specific content included. Every time the target user opens a session (instant messaging window) on the first client, a unique session identifier ID will be generated. The session identifier ID can be but not limited to a one-to-one chat session identifier or a many-to-many group chat session identifier. Specifically, when the target user conducts a one-to-one chat session, the session identifier ID can be the user unique identifiers of both parties of the session spliced ​​according to preset rules (the specific content is not limited). For example, the unique identifier of the target user is aaa, and the unique identifier of user A in the conversation with him is bbb, then the identifier ID of the one-to-one chat session between the two is aaa:bbb.

[0114] When the target user conducts a many-to-many group chat session, the session ID can be the unique ID of the group chat, which is uniformly generated by the system when the group chat is created by the user, and all group members share the same session key. The specific generation method is not limited, such as the Snowflake algorithm, which can generate a unique ID by combining the timestamp, machine ID and serial number. In this way, a globally unique ID can be generated in a highly concurrent distributed environment, and the specific content is not limited.

[0115] In addition, this application does not limit the method of generating EDK. The method adopted by this application is to determine EDK through the interaction between the server and the cryptographic platform (Key Management Service, referred to as KMS). Specifically, the server first sends the session identifier and the public key in the IK to the cryptographic platform so that the cryptographic platform can determine whether the EDK corresponding to the session identifier exists; if it exists, the EDK encrypted with the public key in the IK is returned to the server; if it does not exist, the encryption machine is used to generate EDK according to the session identifier, and the EDK encrypted with the public key in the IK is returned to the server, and then the server sends it to the first client.

[0116] For example: Figure 3 As shown, for each session initiated by the target user, the first client will generate a session identifier and send it to the server. The server will send the session identifier and the public key in the IK corresponding to the target user to the cryptographic platform KMS. After receiving the session identifier and the public key in the IK, the cryptographic platform will first determine whether the EDK corresponding to the session identifier in the encryption machine exists. If so, it will return the EKD. If not, the encryption machine will generate an EDK based on the session identifier to ensure that a corresponding EDK is generated for each session and stored persistently. Then, after the cryptographic platform encrypts the EDK using the public key in the IK corresponding to the target user, it can return the encrypted EDK to the server, and then send the encrypted EDK to the first client through the server to ensure that the entire transmission process of the EDK is encrypted transmission to ensure transmission security.

[0117] Among them, the present application does not limit the specific content and storage method of the EDK generated by the encryption machine according to the session identifier. For example, an EDK example can be: KoZIzj0CAQYIKoEcz1UBgi0, and it can be stored in the encryption machine in the form of a key-value pair <session ID: key>.

[0118] In addition, the present application does not limit the specific content of the encrypted EDK. The encrypted EDK may be exemplified as follows:

[0119] AgEAMBMGByqGSM49AgEGCCqBHM9VAYItB

[0120] Hkwdw{BAQQg3NV8UNoLA2bZrMuiB7+TEScZ

[0121] S103: Decrypt the encrypted EDK using the private key in the IK, and encrypt and digitally sign the session content sent by the target user using the decrypted EDK.

[0122] In this embodiment, after the first client generates and stores an IK including a public key and a private key through step S101, and obtains the EDK encrypted by the public key in the IK through step S102, it can further be transferred to the first terminal device locally, and then the encrypted EDK can be decrypted using the private key in the IK, and the decrypted EDK can be used to encrypt and digitally sign the one-to-one or many-to-many session content sent by the target user to obtain the signed encrypted session content for executing the subsequent step S104.

[0123] Specifically, an optional implementation method is that after the first client uses the private key in the IK to decrypt the encrypted EDK, it can first use the decrypted EDK to encrypt the session content sent by the target user to obtain the ciphertext of the session content (including but not limited to text, files, voice and other instant messaging messages), and then use a one-way hash function to extract the 128-bit summary of the ciphertext of the session content (here defined as the first summary), and use the private key in the IK to encrypt the 128-bit first summary to obtain the encrypted first summary (as signature information), forming the signed encrypted session content, such as Figure 4 As shown, it is used to execute the subsequent step S104.

[0124] S104: Send the signed encrypted session content to the second client, so that after the signature verification is passed, the second client can use the private key in the IK obtained from the server to decrypt the encrypted EDK, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0125] In this embodiment, after the first client forms the signed encrypted session content through step S103, it can further send the signed encrypted session content to the second client (which can be but is not limited to an instant messaging tool client such as WeChat, iFlytek, etc. installed on the second terminal device), so that after the second client passes the signature verification, that is, after ensuring that the sender of the session content (sent by the target user through the first client) and the message content have not been tampered with, it first uses the private key in the IK obtained from the server to decrypt the encrypted EDK, and then uses the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content, and can display it on the display interface of the second client.

[0126] Specifically, an optional implementation method is as follows: Figure 4As shown, after receiving the ciphertext of the session content (including but not limited to text, files, voice and other instant messaging messages) sent by the first client, the encrypted first digest (signature information) and the public key in the IK, the second client can first use a one-way hash function to extract the 128-bit digest of the ciphertext of the session content (defined as the second digest here), and use the public key in the IK to decrypt the encrypted first digest to obtain the decrypted 128-bit first digest, and then determine whether the 128-bit second digest is equal to the decrypted 128-bit first digest. If so, it indicates that the signature verification is passed; if not, the signature verification fails.

[0127] Further, such as Figure 5 As shown, when the signature verification passes, that is, when it is determined that the 128-bit second digest is equal to the decrypted 128-bit first digest, the second client can further determine whether an EDK corresponding to the session identifier already exists locally. If so, the public key in the IK can be sent to the server, so that the private key in the IK can be obtained through the interaction between the server and the first client, and then the private key in the IK is used to decrypt the EDK, and the decrypted EDK is used to decrypt the ciphertext of the session content to obtain the decrypted session content, which is displayed on the display interface of the second client.

[0128] On the contrary, if the second client determines that there is no EDK corresponding to the session identifier locally, it can first send the public key and session identifier in the IK to the server to obtain the EDK corresponding to the session identifier from the server, and then obtain the private key in the IK based on the public key in the IK sent to the server through the interaction between the server and the first client, and then use the private key in the IK to decrypt the EDK corresponding to the session identifier previously obtained from the server, and use the decrypted EDK to decrypt the ciphertext of the session content, and display the decrypted session content on the screen.

[0129] In summary, the present embodiment provides an end-to-end data encryption and decryption method, in which the first client installed on the first terminal device first responds to the target user's login request on the first terminal device, determines the identity key IK corresponding to the target user and the first terminal device; and sends the IK to the server to which the first client belongs; and then responds to the session request issued by the target user, sends the generated session identifier to the server, so as to obtain the EDK encrypted by the public key in the IK from the server. Next, the encrypted EDK is decrypted using the private key in the IK, and the decrypted EDK is used to encrypt and digitally sign the session content issued by the target user. The signed encrypted session content is then sent to the second client, so that after the signature verification is passed, the second client uses the private key in the IK obtained from the server to decrypt the encrypted EDK, and uses the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0130] It can be seen that since the present application utilizes the unique identity key IK corresponding to the target user and the first terminal device and the unique encryption data key EDK corresponding to the session identifier issued by the target user, the encryption and decryption of the session content transmission process issued by the target user is realized. Thus, through this "one machine, one key (IK), one session, one key (EDK)" data encryption and decryption method, the transmission security of the session content issued by the target user is effectively improved.

[0131] Second embodiment

[0132] See also Figure 6 , which is a flow chart of another end-to-end data encryption and decryption method provided by an embodiment of the present application. The method is applied to a second client installed in a second terminal device. Among them, the present application does not limit the specific composition structure of the second terminal device, which can be but not limited to electronic devices such as mobile phones, tablet computers, laptops, netbooks, and wearable devices. The present application does not limit the specific content of the second client, which can be but not limited to instant messaging tool clients such as WeChat and iFlytek. The method specifically includes the following steps:

[0133] S601: Receive signed encrypted session content sent by a first client installed on a first terminal device.

[0134] In the embodiment of the present application, the specific generation process of the signed encrypted session content sent by the first client and received by the second client is as follows: first, after detecting the operation of the target user logging into the first client by entering the account number, password, etc., in response to the login request sent by the target user on the first terminal device, the first client can determine whether the IK corresponding to the target user already exists in the first terminal device according to the target user's identifier and the identifier of the first terminal device. If it exists, no processing is required, and the IK can be directly sent to the server to which the first client belongs; if it does not exist, the existing or future password generation method can be used to generate and store the IK corresponding to the current target user's identifier and the identifier of the first terminal device according to the identifier of the target user and the identifier of the first terminal device. Then, according to the session identifier, the encrypted EDK obtained by encrypting the public key in the IK can be obtained from the server, and the decrypted EDK can be obtained by decrypting the encrypted EDK using the private key in the IK. Then, the decrypted EDK is used to encrypt and digitally sign the session content sent by the target user, and the signed encrypted session content can be obtained. The specific implementation process is basically the same as the description of the above steps S101-S103, which will not be repeated here. For related content, please refer to the above steps S101-S103.

[0135] The signed encrypted session content sent by the first client and received by the second client may include but is not limited to the ciphertext of the session content, the encrypted first digest, and the public key in the IK.

[0136] Specifically, the ciphertext of the session content can be obtained by the first client using the decrypted EDK to encrypt the session content sent by the target user; the encrypted first summary can be obtained by the first client extracting the 128-bit first summary of the ciphertext of the session content using a one-way hash function, and then encrypting the 128-bit first summary using the private key in the IK.

[0137] S602: Verify the signed encrypted session content, and after the verification is passed, use the private key in the IK obtained from the server to decrypt the encrypted EDK, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0138] In an embodiment of the present application, after the second client receives the signed encrypted session content (including but not limited to the ciphertext of the session content, the encrypted first digest and the public key in the IK) sent by the first client installed on the first terminal device through step S601, it can further use a one-way hash function to extract a 128-bit second digest of the ciphertext of the session content, and use the public key in the IK to decrypt the encrypted first digest to obtain the decrypted 128-bit first digest, and then determine whether the 128-bit second digest is equal to the decrypted 128-bit first digest. If so, the signature verification passes; if not, the signature verification fails. For the specific implementation process, please refer to the introduction of step S104 above, which will not be repeated here.

[0139] In a possible implementation of this embodiment, after the signature verification is passed, the second client can further determine whether an EDK corresponding to the session identifier already exists; if so, obtain the private key in the IK from the server; if not, send the session identifier to the server so as to obtain the EDK encrypted by the public key in the IK and the private key in the IK from the server; then the encrypted EDK can be decrypted using the private key in the IK, and the decrypted EDK can be used to decrypt the encrypted session content, and the decrypted session content can be obtained for display on the screen. The specific implementation process can also be found in the introduction of step S104 above, which will not be repeated here.

[0140] In this way, through the encryption and decryption method of "one machine, one password, one message, one password", the transmission security of instant messaging messages sent by target users can be effectively improved.

[0141] Third embodiment

[0142] Next, the interaction process of each component in an end-to-end data encryption and decryption system provided in an embodiment of the present application is introduced.

[0143] See also Figure 7 , the encryption and decryption system includes a first client 701 installed on a first terminal device, a second client 703 installed on a second terminal device, and a server 702 to which the first client and the second client belong. The first client 701 is connected to the server 702, and the second client 703 is connected to the server 702. The above-mentioned "connection" can be a direct connection or an indirect connection. The functions of the server 702 may include but are not limited to storing keys and transmitting instant messaging information (that is, the server 702 can be an application server for generating and storing keys, or a server for providing instant messaging message transmission services, etc.).

[0144] Among them, the first client 701 installed on the first terminal device is used to determine the identity key IK corresponding to the target user and the first terminal device in response to the target user's login request on the first terminal device; and send the IK to the server side; in response to the session request issued by the target user, send the generated session identifier to the server side 702, so as to obtain the EDK encrypted by the public key in the IK from the server side 702; use the private key in the IK to decrypt the encrypted EDK, and use the decrypted EDK to encrypt and digitally sign the session content issued by the target user; send the signed encrypted session content to the second client 703; for the specific implementation process, please refer to the introduction of steps S101-S104 above, which will not be repeated here.

[0145] The server side 702 is used to receive the IK and session identifier sent by the first client; send the session identifier and the public key in the IK to the cryptographic platform so that the cryptographic platform can determine whether the EDK corresponding to the session identifier exists; if it exists, return the EDK encrypted with the public key in the IK to the server side 702; if it does not exist, generate the EDK according to the session identifier using the encryption machine, and return the EDK encrypted with the public key in the IK to the server side 702; for the specific implementation process, please refer to the introduction of steps S101-S104 above, which will not be repeated here.

[0146] The second client 703 is used to receive the signed encrypted session content sent by the first client 701; verify the signed encrypted session content, and after the verification is passed, use the private key in the IK obtained from the server to decrypt the encrypted EDK, and use the decrypted EDK to decrypt the encrypted session content, and display the decrypted session content on the screen. For the specific implementation process, please refer to the introduction of steps S601-S602 above, which will not be repeated here.

[0147] Fourth embodiment

[0148] This embodiment will introduce an end-to-end data encryption and decryption device. For related content, please refer to the first embodiment mentioned above.

[0149] See also Figure 8 , is a schematic diagram of the composition of an end-to-end data encryption and decryption device provided in this embodiment. The device 800 is applied to a first client installed in a first terminal device, and includes:

[0150] A determination unit 801 is configured to determine an identity key IK corresponding to the target user and the first terminal device in response to a login request of the target user at the first terminal device; and send the IK to a server to which the first client belongs;

[0151] The first sending unit 802 is used to send the generated session identifier to the server side in response to the session request sent by the target user, so as to obtain the encrypted data key EDK encrypted by the public key in the IK from the server side;

[0152] The encryption unit 803 is used to decrypt the encrypted EDK using the private key in the IK, and to encrypt and digitally sign the session content sent by the target user using the decrypted EDK;

[0153] The decryption unit 804 is used to send the signed encrypted session content to the second client, so that the second client can use the private key in the IK obtained from the server to decrypt the encrypted EDK after the signature verification, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0154] In an implementation of this embodiment, the determining unit 801 includes:

[0155] A judgment subunit, configured to respond to a login request of a target user at a first terminal device and judge, according to an identifier of the target user and an identifier of the first terminal device, whether an identity key IK corresponding to the target user and the first terminal device already exists;

[0156] A generating subunit is used to generate and store the identity key IK corresponding to the target user and the first terminal device according to the identifier of the target user and the identifier of the first terminal device if it is determined that the identity key IK corresponding to the target user and the first terminal device does not exist; the IK includes a public key and a private key.

[0157] In an implementation manner of this embodiment, the session identifier is a one-to-one single chat session identifier or a many-to-many group chat session identifier.

[0158] In an implementation of this embodiment, the device further includes:

[0159] The second sending unit is used to send the session identifier and the public key in the IK to the cryptographic platform through the server side, so that the cryptographic platform determines whether the EDK corresponding to the session identifier exists; if it exists, the EDK encrypted by using the public key in the IK is returned to the server side; if it does not exist, the EDK is generated according to the session identifier by using the encryption machine, and the EDK encrypted by using the public key in the IK is returned to the server side.

[0160] In one implementation of this embodiment, the encryption unit 803 includes:

[0161] A first encryption subunit, configured to encrypt the session content sent by the target user using the decrypted EDK to obtain a ciphertext of the session content;

[0162] The second encryption subunit is used to extract the 128-bit first summary of the ciphertext of the session content by using a one-way hash function, and encrypt the 128-bit first summary by using the private key in the IK to obtain the encrypted first summary.

[0163] In an implementation of this embodiment, the decryption unit 804 is specifically used for:

[0164] Sending the ciphertext of the session content, the encrypted first digest and the public key in the IK to the second client, so that the second client extracts the 128-bit second digest of the ciphertext of the session content by using a one-way hash function, and decrypts the encrypted first digest by using the public key in the IK to obtain the decrypted 128-bit first digest, and after determining that the 128-bit second digest is equal to the decrypted 128-bit first digest, decrypts the encrypted EDK by using the private key in the IK obtained from the server, and decrypts the ciphertext of the session content by using the decrypted EDK to obtain the decrypted session content.

[0165] Fifth embodiment

[0166] This embodiment will introduce another end-to-end data encryption and decryption device. For related content, please refer to the second embodiment mentioned above.

[0167] See also Fig. 9 , is a schematic diagram of another end-to-end data encryption and decryption device provided in this embodiment. The device 900 is applied to a second client installed in a second terminal device, and includes:

[0168] The receiving unit 901 is used to receive the signed encrypted session content sent by the first client installed in the first terminal device; wherein the signed encrypted session content is obtained by encrypting and digitally signing the session content sent by the target user using the decrypted EDK; the decrypted EDK is obtained by decrypting the encrypted EDK using the private key in the IK; the encrypted EDK is obtained by encrypting the public key in the IK after being obtained from the server to which the first client belongs according to the session identifier; the IK is determined by the first client in response to the login request of the target user on the first terminal device;

[0169] The decryption unit 902 is used to verify the signed encrypted session content, and after the verification is passed, use the private key in the IK obtained from the server to decrypt the encrypted EDK, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

[0170] In an implementation of this embodiment, the receiving unit 901 is specifically configured to:

[0171] Receiving the ciphertext of the session content, the encrypted first digest and the public key in the IK sent by the first client installed on the first terminal device;

[0172] Among them, the ciphertext of the session content is obtained by the first client using the decrypted EDK to encrypt the session content sent by the target user; the encrypted first summary is obtained by the first client using a one-way hash function to extract the 128-bit first summary of the ciphertext of the session content, and then encrypting the 128-bit first summary using the private key in the IK.

[0173] In an implementation of this embodiment, the decryption unit 902 includes:

[0174] A first decryption subunit is used to extract a 128-bit second summary of the ciphertext of the session content by using a one-way hash function, and decrypt the encrypted first summary by using the public key in the IK to obtain a decrypted 128-bit first summary;

[0175] The first judgment subunit is used to judge whether the 128-bit second digest is equal to the decrypted 128-bit first digest. If so, the signature verification is passed; if not, the signature verification fails.

[0176] In an implementation of this embodiment, the decryption unit 902 further includes:

[0177] A second judgment subunit is used to judge whether the EDK corresponding to the session identifier already exists after the signature verification is passed;

[0178] an acquisition subunit, configured to acquire the private key in the IK from the server side if it is determined that the EDK corresponding to the session identifier already exists; and to send the session identifier to the server side if it is determined that the EDK corresponding to the session identifier does not exist, so as to acquire the EDK encrypted by the public key in the IK and the private key in the IK from the server side;

[0179] The second decryption subunit is used to decrypt the encrypted EDK using the private key in the IK, and decrypt the encrypted session content using the decrypted EDK to obtain the decrypted session content.

[0180] Furthermore, an embodiment of the present application also provides an end-to-end data encryption and decryption device, including: a processor, a memory, and a system bus;

[0181] The processor and the memory are connected via the system bus;

[0182] The memory is used to store one or more programs, and the one or more programs include instructions. When the instructions are executed by the processor, the processor executes any implementation method of the end-to-end data encryption and decryption method provided in the first embodiment or executes any implementation method of the end-to-end data encryption and decryption method provided in the second embodiment.

[0183] Furthermore, an embodiment of the present application also provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a terminal device, the terminal device executes any implementation method of the end-to-end data encryption and decryption method provided in the first and second embodiments above.

[0184] Furthermore, an embodiment of the present application also provides a computer program product. When the computer program product is run on a terminal device, the terminal device executes any one of the implementation methods of the end-to-end data encryption and decryption methods provided in the first and second embodiments above.

[0185] It can be known from the description of the above implementation mode that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., including several instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a media gateway, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0186] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0187] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0188] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An end-to-end data encryption and decryption method, characterized in that: The first client installed on the first terminal device includes: In response to a login request of a target user at a first terminal device, determining an identity key IK corresponding to the target user and the first terminal device; and sending the IK to a server to which the first client belongs; In response to a session request sent by the target user, the generated session identifier is sent to the server side, so as to obtain the encrypted data key EDK encrypted by the public key in the IK from the server side; Decrypting the encrypted EDK using the private key in the IK, and encrypting and digitally signing the session content sent by the target user using the decrypted EDK; The signed encrypted session content is sent to the second client, so that after the signature verification is passed, the second client uses the private key in the IK obtained from the server to decrypt the encrypted EDK, and uses the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

2. The method according to claim 1, characterized in that The determining, in response to a login request of a target user at a first terminal device, an identity key IK corresponding to the target user and the first terminal device comprises: In response to a login request of a target user at a first terminal device, judging, according to an identifier of the target user and an identifier of the first terminal device, whether an identity key IK corresponding to the target user and the first terminal device already exists; If not, an identity key IK corresponding to the target user and the first terminal device is generated and stored according to the identifier of the target user and the identifier of the first terminal device; the IK includes a public key and a private key.

3. The method according to claim 1, characterized in that The session identifier is a one-to-one chat session identifier or a many-to-many group chat session identifier.

4. The method according to claim 1, characterized in that: The encrypted EDK is generated as follows: The session identifier and the public key in the IK are sent to the cryptographic platform through the server side so that the cryptographic platform can determine whether the EDK corresponding to the session identifier exists; if it exists, the EDK encrypted by the public key in the IK is returned to the server side; if it does not exist, the EDK is generated according to the session identifier by using the encryption machine, and the EDK encrypted by the public key in the IK is returned to the server side.

5. The method according to claim 1, characterized in that The step of using the decrypted EDK to encrypt and digitally sign the session content sent by the target user includes: Encrypt the session content sent by the target user using the decrypted EDK to obtain the ciphertext of the session content; A 128-bit first summary of the ciphertext of the session content is extracted using a one-way hash function, and the 128-bit first summary is encrypted using a private key in the IK to obtain an encrypted first summary.

6. The method according to claim 5, characterized in that The sending of the signed encrypted session content to the second client so that the second client decrypts the encrypted EDK using the private key in the IK obtained from the server after the signature verification is passed, and decrypts the encrypted session content using the decrypted EDK to obtain the decrypted session content, including: Sending the ciphertext of the session content, the encrypted first digest and the public key in the IK to the second client, so that the second client extracts the 128-bit second digest of the ciphertext of the session content by using a one-way hash function, and decrypts the encrypted first digest by using the public key in the IK to obtain the decrypted 128-bit first digest, and after determining that the 128-bit second digest is equal to the decrypted 128-bit first digest, decrypts the encrypted EDK by using the private key in the IK obtained from the server, and decrypts the ciphertext of the session content by using the decrypted EDK to obtain the decrypted session content.

7. An end-to-end data encryption and decryption method, characterized in that: The second client installed on the second terminal device includes: Receive the signed encrypted session content sent by the first client installed on the first terminal device; wherein the signed encrypted session content is obtained by encrypting and digitally signing the session content sent by the target user using the decrypted EDK; the decrypted EDK is obtained by decrypting the encrypted EDK using the private key in the IK; the encrypted EDK is obtained by encrypting the public key in the IK after being obtained from the server to which the first client belongs according to the session identifier; the IK is determined by the first client in response to the target user's login request on the first terminal device; The signed encrypted session content is verified, and after the verification is passed, the encrypted EDK is decrypted using the private key in the IK obtained from the server, and the encrypted session content is decrypted using the decrypted EDK to obtain the decrypted session content.

8. The method according to claim 7, characterized in that The receiving of the signed encrypted session content sent by the first client installed on the first terminal device includes: Receiving the ciphertext of the session content, the encrypted first digest and the public key in the IK sent by the first client installed on the first terminal device; Among them, the ciphertext of the session content is obtained by the first client using the decrypted EDK to encrypt the session content sent by the target user; the encrypted first summary is obtained by the first client using a one-way hash function to extract the 128-bit first summary of the ciphertext of the session content, and then encrypting the 128-bit first summary using the private key in the IK.

9. The method according to claim 8, characterized in that The verifying the signed encrypted session content includes: Extracting a 128-bit second summary of the ciphertext of the session content using a one-way hash function, and decrypting the encrypted first summary using the public key in the IK to obtain a decrypted 128-bit first summary; It is determined whether the 128-bit second digest is equal to the decrypted 128-bit first digest. If so, the signature verification is successful; if not, the signature verification fails.

10. The method according to claim 7, characterized in that After the signature verification is passed, the encrypted EDK is decrypted using the private key in the IK obtained from the server, and the encrypted session content is decrypted using the decrypted EDK to obtain the decrypted session content, including: After the signature verification is passed, determine whether the EDK corresponding to the session identifier already exists; If yes, the private key in the IK is obtained from the server; if no, the session identifier is sent to the server so as to obtain the EDK encrypted by the public key in the IK and the private key in the IK from the server; The encrypted EDK is decrypted using the private key in the IK, and the encrypted session content is decrypted using the decrypted EDK to obtain the decrypted session content.

11. An end-to-end data encryption and decryption device, characterized in that: The first client installed on the first terminal device includes: A determination unit, configured to determine, in response to a login request of a target user at a first terminal device, an identity key IK corresponding to the target user and the first terminal device; and send the IK to a server to which the first client belongs; A first sending unit, configured to send the generated session identifier to the server side in response to a session request sent by the target user, so as to obtain the encrypted data key EDK encrypted by the public key in the IK from the server side; An encryption unit, used to decrypt the encrypted EDK using the private key in the IK, and to encrypt and digitally sign the session content sent by the target user using the decrypted EDK; A decryption unit is used to send the signed encrypted session content to the second client, so that the second client can use the private key in the IK obtained from the server to decrypt the encrypted EDK after the signature verification, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

12. An end-to-end data encryption and decryption device, characterized in that: The second client installed on the second terminal device includes: A receiving unit, configured to receive the signed encrypted session content sent by the first client installed on the first terminal device; wherein the signed encrypted session content is obtained by encrypting and digitally signing the session content sent by the target user using the decrypted EDK; the decrypted EDK is obtained by decrypting the encrypted EDK using the private key in the IK; the encrypted EDK is obtained by encrypting the public key in the IK after being obtained from the server to which the first client belongs according to the session identifier; the IK is determined by the first client in response to a login request of the target user on the first terminal device; The decryption unit is used to verify the signed encrypted session content, and after the verification is passed, use the private key in the IK obtained from the server to decrypt the encrypted EDK, and use the decrypted EDK to decrypt the encrypted session content to obtain the decrypted session content.

13. An end-to-end data encryption and decryption system, characterized in that: include: A first client installed on the first terminal device, a second client installed on the second terminal device, and a server to which the first client and the second client belong; The first client installed in the first terminal device is used to determine the identity key IK corresponding to the target user and the first terminal device in response to a login request of the target user at the first terminal device; and send the IK to the server end; In response to a session request sent by the target user, the generated session identifier is sent to the server side, so as to obtain the encrypted data key EDK encrypted by the public key in the IK from the server side; Decrypting the encrypted EDK using the private key in the IK, and encrypting and digitally signing the session content sent by the target user using the decrypted EDK; Sending the signed encrypted session content to the second client; The server is used to receive the IK and session identifier sent by the first client; Send the session identifier and the public key in the IK to the cryptographic platform so that the cryptographic platform determines whether the EDK corresponding to the session identifier exists; if so, return the EDK encrypted by the public key in the IK to the server; if not, generate the EDK according to the session identifier by using the encryption machine, and return the EDK encrypted by the public key in the IK to the server; The second client is used to receive the signed encrypted session content sent by the first client; The signed encrypted session content is verified, and after the verification is passed, the encrypted EDK is decrypted using the private key in the IK obtained from the server, and the encrypted session content is decrypted using the decrypted EDK to obtain the decrypted session content.

14. An end-to-end data encryption and decryption device, characterized in that: include: Processor, memory, system bus; The processor and the memory are connected via the system bus; The memory is used to store one or more programs, and the one or more programs include instructions, which, when executed by the processor, enable the processor to execute the method of any one of claims 1 to 6 or the method of any one of claims 7 to 10.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device executes the method according to any one of claims 1 to 10.

Images